Secure IoT Deployment Checklist for Building Management System

A Building Management System (BMS) enables the capability to control the infrastructure within a building. BMS can be considered a miniature industrial control system, which is more conventional and prevalent. The legacy architecture of the BMS assumes every device has to be connected physically. Due to this reason, installing Internet of Things (IoT) devices may introduce new security loopholes in the existing BMS. Moreover, an adversary may utilize the communication channel between the BMS and IoT devices to launch cyber-attacks. In this paper, we created a prototype setup of a BMS with IoT devices to study the deployment and how the system can be installed. We introduced a comprehensive IoT security deployment checklist to assess IoT solutions' security posture, specifically focusing on the BMS system. This checklist is novel to the market as the existing works are mostly targeted at IoT but are not fully applicable to BMS.